In real corporate environments (where, keep in mind, most users are very non-sophisticated), this kind of inline scanning is extremely valuable. TLS intercepted

In real corporate environments (where, keep in mind, most users are very non-sophisticated), this kind of inline scanning is extremely valuable. TLS intercepted data is also invaluable for post-incident investigation, for example, to determine whether or not a host A/V detection is likely valid without having to go through a costly and disruptive host forensics process (typically by grabbing the file out of retained data, or just by determining where the file actually came from). In fact, without TLS interception, post-incident investigation based on network artifacts is becoming more and more impractical as malicious actors are taking advantage of LetsEncrypt and CloudFlare to HTTPS protect their delivery and C2.